This is the accessible text file for GAO report number GAO-04-529T 
entitled 'Internal Revenue Service: Individual Taxpayer 
Indentification Numbers Can Be Improperly Obtained and Used' which was 
released on March 10, 2004.

This text file was formatted by the U.S. General Accounting Office 
(GAO) to be accessible to users with visual impairments, as part of a 
longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately.


Before the Subcommittee on Oversight and Social Security, Committee on 
Ways and Means, House of Representatives: 

For Release on Delivery Expected at 10 a.m. EDT Thursday, March 10, 

Internal revenue service: 

Individual Taxpayer Identification Numbers Can Be Improperly Obtained 
and Used: 

Statement of Michael Brostek, Director, Tax Issues: 

[Hyperlink, http: //]: 

GAO Highlights: 

Highlights of GAO-04-529, a report to a testimony to the House Ways and 
Means Subcommittees on Oversight and on Social Security 

Why GAO Did This Study: 

The Internal Revenue Service (IRS) issues Individual Taxpayer 
Identification Numbers (ITINs) to those who are not eligible for a 
social security number (SSN) from the Social Security Administration 
(SSA). ITIN-related concerns include whether any weaknesses in IRS’s 
controls would allow ITINs to be issued and used for illegal purposes 
and possible security breaches, whether employers are confused about 
their responsibilities to IRS, SSA, and the Department of Homeland 
Security (DHS) for identifying their employees, and how IRS, SSA, and 
DHS share data when illegal resident aliens receive ITINs. 

Because of these concerns, GAO was asked to: (1) describe why IRS 
created the ITIN, (2) describe IRS’s processes and controls for issuing 
ITINs, (3) do a limited test of IRS’s processes and controls, and (4) 
describe certain concerns and problems for employers and government 
agencies when ITINs are issued to illegal resident aliens. 

What GAO Found: 

IRS created the ITIN in 1996 to improve tax administration. IRS needed 
a better way to identify the tax reporting of those who could not 
obtain an SSN to use on tax returns and other tax documents. The 
cumulative number of ITINs issued exceeded 7 million by the end of 

IRS receives ITIN applications from the mail, applicants walking into 
IRS offices, and authorized non-IRS entities. In December 2003, IRS 
made changes to improve its ITIN controls. However, IRS remains limited 
in its ability to verify applicants’ identities. For instance, IRS 
staff does not see most applicants and IRS does not verify the validity 
of documents. 

Before December 2003, GAO staff obtained an ITIN by submitting bogus 
documents through the mail and used the ITIN to open a bank account and 
obtain an ATM card. Staff also fabricated an ITIN and used it to obtain 
a voter registration card. While limited, this test indicates that 
IRS’s controls could be bypassed and that an ITIN could be used for 
nontax purposes. Despite the December changes, the weaknesses GAO 
exploited remain. Resolving these limitations could be challenging.

IRS has concluded that most resident aliens who have ITINs and earn 
wage income are not legally employed in the United States. Given this 
context, the use of ITINs raises various issues. Employers have raised 
concerns that when they identify employees and their work eligibility, 
they could have conflicting obligations to IRS, SSA, and DHS. These 
concerns appear to be largely unfounded if employers do what is 
specifically required. Data sharing—especially of IRS data—may help DHS 
to target immigration enforcement, but, among other things, officials 
cited legal restrictions and the potential for employment to be hidden 
from tax administrators as affecting their decisions about sharing 

What GAO Recommends: 

Although GAO is not making recommendations, this hearing is a useful 
venue for Congress to consider whether to provide IRS, SSA, and DHS 
guidance on how to address concerns about ITIN issuance controls and 
policies for dealing with illegal resident aliens.

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact Michael Brostek at 
(202) 512-9110 or

[End of section]

Messrs. Chairmen and Members of the Subcommittees: 

I am pleased to participate in the hearing today on various issues 
related to the Individual Taxpayer Identification Number (ITIN) issued 
by the Internal Revenue Service (IRS). As you requested, my statement 
today describes why IRS created the ITIN, the processes and controls 
IRS has in place for issuing ITINs, the results of our limited test of 
the controls over issuing an ITIN, and certain concerns and problems 
for employers and government agencies that ensue when ITINs are issued 
to illegal resident aliens.[Footnote 1]

IRS issues ITINs to individuals who are required to have a U.S. 
taxpayer identification number (TIN) but who are not eligible to obtain 
a social security number (SSN) from the Social Security Administration 
(SSA). An ITIN has nine digits formatted like an SSN (NNN-NN-NNNN) but 
beginning with the number "9".[Footnote 2] IRS issues ITINs for tax 
processing purposes only. Having an ITIN does not affect a holder's 
immigration status, or authorize the holder to work or receive Social 
Security benefits.

In requesting this testimony, you sought a better understanding of the 
vulnerabilities in the ITIN issuance process, including whether 
weaknesses allow ITINs to be issued and used for illegal purposes and 
possible security breaches. You also expressed interest in the extent 
to which employers may be confused by their responsibilities vis-ŕ-vis 
IRS, SSA, and the Department of Homeland Security (DHS) in ensuring the 
identity of their employees, and whether federal agencies are sharing 
information to deal with illegal resident aliens who may be issued 

Today's statement is based on interviews, reviews of agency documents 
and various publications, and limited tests of the ITIN issuance 
controls. Specifically, to address the four areas, we interviewed 
officials from IRS including the Taxpayer Advocate Service, SSA, and 
the Departments of the Treasury, Homeland Security, and Labor. We 
reviewed documents from these agencies as well as other literature. In 
addition, our Office of Special Investigations (OSI) did limited 
testing of IRS's controls to determine whether it could fraudulently 
obtain an ITIN by mailing or presenting bogus identity documents to 
IRS. OSI used an IRS-issued ITIN and a fake ITIN it generated for 
nontax purposes. We did our work in Washington, D.C. from September 
2003 through February 2004 in accordance with generally accepted 
government auditing standards and we performed our investigative work 
in accordance with standards prescribed by the President's Council on 
Integrity and Efficiency.

Our results in these four areas showed that: 

* IRS created the ITIN in 1996 to improve tax administration. IRS 
needed a better way to identify and track the tax reporting of 
noncitizens that could not obtain an SSN for use when filing tax 
returns. Beyond the filing of tax returns, ITINS have other legitimate 
tax uses, such as for filing documents other than tax returns and for 
claiming benefits related to a tax treaty. According to IRS, most ITINs 
have been used at least once on a tax return and ITINs also have been 
used for other legitimate tax purposes.

* IRS made changes to improve its processes for issuing ITINs in 
December 2003, but continues to have limited controls to verify the 
identity of ITIN applicants. For example, the majority of ITIN 
applicants apply by mail and IRS cannot be sure the applicant is the 
same individual described by the documentation submitted. IRS also does 
not verify with third parties the validity of the documents submitted 
with the ITIN applications.

* Before IRS changed its procedures in December, we obtained an ITIN by 
applying with bogus documents through the mail. We also created a bogus 
ITIN without applying to IRS. Using the IRS-issued ITIN, we opened a 
bank account and obtained an ATM card. We used the bogus ITIN to obtain 
a voter registration card. While very limited, this test illustrates 
weaknesses in IRS's ITIN controls, which have not been completely 
addressed by the changes made in December, and shows that ITINs can be 
used for nontax purposes, such as blending into society under a false 
identity. Resolving the continuing limitations in IRS's ITIN issuance 
controls would be challenging.

* Although precise data are not available, hundreds of thousands of 
ITINs are issued to aliens who subsequently earn wage income. IRS and 
the Treasury Inspector General for Tax Administration (TIGTA) have 
concluded that these individuals are illegal resident aliens. Given 
this context, employers have raised concerns about potentially 
conflicting obligations to IRS, SSA, and DHS when they identify 
employees and their work eligibility. These concerns appear to be 
largely unfounded if employers do what is specifically required. 
Sharing IRS data with DHS may provide enhanced information to target 
enforcement of immigration laws, but to differing degrees, officials 
cited such factors as legal restrictions and the potential for 
employment to be hidden from tax administrators as affecting their 
decisions about whether and how to share data.


IRS requires a unique TIN to process any tax return or tax-related 
document, and associate the return or document with a taxpayer's 
history. A TIN allows IRS to better manage a host of tax administration 
functions--such as crediting tax payments, and verifying compliance in 
filing returns, reporting income, and paying taxes. IRS also needs it 
to process information returns filed by employers and financial 
institutions to report certain types of payments (e.g., wages or 
interest) made to individuals.

One type of TIN is the SSN, which SSA is authorized to issue to United 
States citizens, aliens allowed to work in the United States, or 
others, in limited cases, for nonwork purposes. For example, according 
to SSA, if an applicant only needs an SSN to obtain certain government 
benefits as specified in SSA regulations, SSA must issue an SSN and 
social security card but the card specifically states that it is not 
valid for work purposes. Individuals must use an SSN when filing a 
required tax return, unless they cannot legally obtain an SSN.

For those who cannot obtain an SSN but need a TIN for tax purposes, IRS 
created the ITIN. IRS's 2003 training manual on ITINs identifies such 
individuals, as shown below.

* An alien who does not reside in the United States and who is filing a 
U.S. tax return to (1) claim a tax treaty benefit, (2) claim a tax 
refund, or (3) file a joint tax return with a spouse who is a U.S. 
citizen or resident.

* An alien who lives in the United States and who is filing a U.S. tax 

* Individuals claimed on a U.S. tax return as a (1) dependent, or (2) 

An alien is a resident for tax purposes if the individual (1) is a 
lawful permanent resident (green card test[Footnote 3]) in the United 
States for any time during the year, (2) is present in the United 
States for 31 or more calendar days during the current year and for a 
substantial time--183 or more weighted days--during a 3-year period 
weighted toward the current year (substantial presence test), or (3) 
elects to be treated as a U.S. resident (first-year election 
test).[Footnote 4]

IRS does not believe that it has the legal authority to distinguish 
between legal and illegal resident aliens for tax purposes. Individuals 
who meet the definition of a resident alien are generally taxed in the 
same manner as U.S. citizens and holders of green cards, meaning that 
they are taxed on their worldwide income. One exception is that 
resident aliens who have ITINs are ineligible to claim the refundable 
earned income tax credit, which requires a valid SSN issued for work 
purposes. A nonresident alien is subject to tax on income from U.S. 
sources but generally not on foreign source income.

IRS Created the ITIN to Improve Tax Adminstration: 

IRS created the ITIN in July 1996 to improve tax administration for 
individuals who were ineligible to obtain an SSN. IRS needed a better 
way to identify and track tax filing and reporting by these individuals 
and by employers and financial institutions that file other tax 
documents related to the individual's income.

Each individual taxpayer is to use a unique and permanent TIN, which 
allows IRS to associate their filed tax returns with their tax records 
and with information returns on payments made to them, and to more 
effectively use programs to enforce tax filing and reporting 
compliance. For individuals who lacked an SSN, IRS did not have a 
permanent TIN to use in tracking their tax obligations and history 
prior to the ITIN.

Prior to July 1996, IRS used a system of temporary TINs when a taxpayer 
did not have an SSN to facilitate one-time processing of a tax return. 
The temporary TIN was assigned to a return filed without an SSN rather 
than to a taxpayer. However, IRS had to post returns with temporary 
TINs to the invalid segment of IRS's masterfile because these returns 
could not be associated with a valid taxpayer account.[Footnote 5] 
Posting to the invalid segment created problems for IRS enforcement 
programs, such as negating income verification through document 
matching. Because the temporary TINs were unique to IRS, IRS could not 
easily match the amounts of income and withheld taxes reported on these 
tax returns against information returns submitted by third parties to 
report such amounts.

In 1995, we reported that accounts in the invalid segment had more than 
doubled the growth rate compared to those in the valid segment from 
1986 through 1994. We also reported that IRS refunded $1.4 billion for 
tax year 1993 returns posted to the invalid segment.[Footnote 6] 
Although no one knows how much of this $1.4 billion may have been 
erroneously refunded, the risk was higher because IRS had less 
certainty about these filers' identities absent a valid TIN and about 
the accuracy of their returns absent the ability to match a filed 
return with third-party data.

Also, prior to December 1996, SSA was issuing "nonwork" SSNs to 
individuals who had tax obligations but were not authorized to work or 
were not otherwise part of the social security system. With the growth 
in the earnings suspense file--SSA records that could not be associated 
with a wage earner, SSA decided to reduce the number of nonwork SSNs. 
Starting in December 1996, SSA tightened restrictions on who could 
apply for a nonwork SSN.

In response to these events and the needs of tax administration, IRS 
created the ITIN as a permanent TIN assigned to individuals who needed 
to file a tax return but were ineligible to obtain an SSN. Among other 
things, IRS was concerned was that information returns could not be 
matched with a tax return. Such returns report third-party payments 
made to those such as nonresident aliens who invested in companies or 
real estate in the United States, or received rent and royalty 

IRS issued its first ITINs in July 1996. Figure 1 shows that IRS has 
issued over 7.2 million ITINs through December 2003 and over 1 million 
ITINs annually in more recent years.[Footnote 7]

Figure 1: Number of ITINs Issued Annually and Cumulative Total, 
Calendar Years 1996 to 2003: 

[See PDF for image]

Note: 1996 does not cover a full calendar year because the ITIN program 
began in July 1996.

[End of figure]

According to IRS, most of the ITINs issued have been used for 
legitimate tax purposes such as on tax returns and other tax-related 
documents. IRS analysis in 2003 showed that about 75 percent of the 
ITINs issued since its inception through September 2003 have been used 
at least once on filed tax returns as a required identification number. 
The actual portion of ITINs used for tax purposes would be higher than 
75 percent if IRS had computed the frequency of uses beyond return 
filing such as to: (1) obtain treaty benefits or exemptions from 
withheld tax, and (2) file information returns on payments made, such 
as Forms W-2 (Wage and Tax Statement) for wage income. IRS does not 
track the frequency of these other uses.

IRS Provides Multiple Ways to Obtain an ITIN but Its Controls to Verify 
the Correctness of Issuance and Use Are Limited: 

IRS provides multiple avenues to apply for an ITIN, all of which result 
in IRS reviewing the applications and documents to establish an 
individual's identity. However, IRS's controls over the issuance and 
use of ITINs are limited. IRS made changes to improve its controls in 
December 2003, but the changes did not fully address the control 
limitations. Among other limitations, IRS does not see most applicants, 
documents are not verified with third parties, and few staff can 
translate or verify foreign language documents.

ITIN Application Process: 

Individuals apply for ITINs by filing a Form W-7 (Application for IRS 
Individual Taxpayer Identification Number) with IRS. As of December 17, 
2003, applicants must provide the tax return for which an ITIN is 
needed, and documentation and a photograph to verify their identity and 
foreign status, such as a passport, driver's license, or identity card.

The ITIN application can be mailed to IRS, submitted at an IRS walk-in, 
taxpayer assistance center, or submitted through an acceptance agent. 
Each way has slightly different procedures and requirements.

* An applicant can mail Form W-7 and supporting documents to the 
Philadelphia Service Center (campus). The documents must be originals 
or notarized copies. Under IRS procedures, the documents are to be 
examined by an ITIN unit employee and originals are to be returned to 
the applicant while IRS is to retain notarized copies. According to 
IRS, this mail option historically accounts for about 70 percent of the 

* An applicant can apply at an IRS taxpayer assistance center that 
provides walk-in assistance. An IRS employee is to review the 
application and documents submitted. If the employee deems the 
documented proof to be satisfactory, the employee is to make an 
appropriate notation on Form W-7, copy the documents, and return them 
to the applicant. The employee is to transmit Form W-7 and the copied 
documents to Philadelphia for final review and issuance of the ITIN. If 
the employee deems the documents to be suspect or unsatisfactory, the 
employee is to return them to the applicant. According to IRS, about 20 
percent of applicants use this walk-in option.

* An applicant can use the services of an IRS-approved acceptance 
agent.[Footnote 8] Agents include colleges, financial institutions, and 
accounting firms, and can be located outside of the United States. 
Acceptance agents help prepare a Form W-7 and must submit this form and 
related documentation to IRS. Certified acceptance agents are 
authorized to also certify whether the documented proof is adequate. 
They are required to keep copies of the documents for 3 years after 
making an appropriate notation on the Form W-7 and forwarding it to 
IRS. Less than 5 percent of applicants use an acceptance agent--whether 
or not certified.

Limited Controls Over ITIN Issuance: 

IRS has limited controls to verify ITIN applicants' identities. Among 
the key limitations in the issuance process are that IRS employees do 
not have to see the applicant in most cases to verify their identity, 
applicants' documents are not verified with third parties, and IRS has 
few staff able to translate or verify foreign language documents.

IRS's ability to establish the applicant's identity is hindered when 
IRS employees do not see the applicant as they review identifying 
information and photographs submitted. This is the case for 
applications that are sent through the mail, which account for 70 
percent of applications. A similar problem can arise for "walk in" 
applications because third parties can submit a Form W-7 for ITIN 
applicants. As long as the Form W-7 is signed and documentation is 
provided, IRS does not require applicants to appear.

IRS employees may have difficulty in determining the validity of an 
unfamiliar document submitted with a Form W-7 to verify identity. An 
IRS letter to state motor vehicle departments in August 2003 indicated 
that IRS generally accepts documents submitted with a Form W-7 at face 
value without validating their authenticity with issuing agencies, or, 
as discussed above, requiring applicants to appear in person. As of 
December 17, 2003, IRS listed 13 types of documents that could be used, 
such as a passport, foreign voter registration card, visa, or U.S. or a 
foreign driver's license.[Footnote 9] Prior to that, IRS had listed 40 
types of documents. IRS reduced the list, in part, because of the 
difficulty for IRS employees who see low volumes of Forms W-7 to know 
all types of documents.

Even with this reduction in the number of acceptable types of 
documents, IRS employees still can encounter many variations to 
consider for each type of document. For example, an IRS research study 
completed in October 2003 indicated that 17 countries accounted for 85 
percent to 87 percent of the ITIN applicants during 1999 through 2001. 
In each of these years, Mexican citizens accounted for 54 percent to 57 
percent of the ITIN applications submitted to IRS. The remaining ITIN 
applicants can come from many other countries. Each country could have 
unique formats for each type of acceptable document, which may be 
unfamiliar to IRS employees.

IRS employees have limited capability to interpret documents submitted 
in a foreign language. IRS does not track how many documents are 
submitted in a foreign language but as noted above, ITIN applicants can 
come from many countries. As of October 2003, 10 of the 230 employees 
at the ITIN Philadelphia site were bilingual---6 in Spanish, 1 in 
Chinese, 1 in Korean, 1 in Japanese, and 1 in Ukrainian/Polish, 
according to IRS.

Nor does IRS generally require ITIN applicants to provide translated 
copies of documents submitted in a foreign language. According to the 
Form W-7 instructions, the applicant may be required to provide a 
certified translation of the foreign language document to obtain an 
ITIN. IRS states that it will attempt to translate any foreign 
documents provided. If IRS cannot translate it, IRS's procedure is to 
ask the applicant for the required translation.

Even if documents can be read, some IRS employees do not have much 
experience in judging whether the documents are genuine. According to 
IRS officials, much of this knowledge comes from on-the-job experience-
-employees that see more documents are more likely to be able to spot 
an invalid or bogus document. Each IRS employee that provides taxpayer 
assistance receives the standard 8-hour IRS training on ITIN, including 
document identification and validation, given to all employees when 
hired--whether the employee handles ITIN applications in Philadelphia 
or at a walk-in site.

IRS Is Attempting to Improve ITIN Issuance Controls: 

Knowing of weaknesses in its ITIN processes and controls, IRS has made 
some changes to improve its controls and is considering other 
improvements. IRS's concern about the large number of ITINs issued 
prompted creation of a task force in 2002 to conduct an in-depth review 
of ITINs. The task force identified many problems and recommendations 
in its September 2002 final report. IRS designated 22 recommendations 
as high priority, and created an ITIN office to study their feasibility 
and oversee any implementation.

We did not have time to review the implementation status of all 22 
recommendations but know that action has been taken on some of the 
recommendations. For example, IRS has started a campaign to educate 
states, employers, financial institutions, and other government 
agencies on the appropriate use of ITINs. To this end, IRS sent letters 
in August 2003 to the directors of all state motor vehicle departments 
asking them to not accept ITINs for drivers' license purposes. IRS also 
has considered legislative proposals to make ITIN use illegal for 
nontax purposes, and to assess information return penalties for 
improper Form W-7 filings.

IRS announced three other recommendations that took effect on December 
17, 2003. First, to help eliminate the nontax use of ITINs, the 
applicant will have to show a federal tax purpose for seeking the ITIN. 
A Form W-7 application without proof that an ITIN is needed for federal 
tax purposes is to be rejected. IRS is requiring taxpayers to attach 
the tax return for which an ITIN is needed to a Form W-7.[Footnote 10] 
Nonresident aliens who need an ITIN for tax purposes other than filing 
a tax return, such as to obtain tax treaty benefits, will need to prove 
ownership of the asset that is eligible for a benefit when they file 
the Form W-7. Second, as mentioned earlier, IRS reduced to 13 from 40 
the number of documents that it will accept as proof of identity to 
obtain an ITIN. Third, IRS will no longer issue an ITIN card, reasoning 
that the card could be mistaken for an SSN card. Rather, it will issue 
an authorization letter. Although these changes appear to have the 
potential to better ensure that ITINs are issued for valid tax-related 
purposes, we do not know how much these changes may improve IRS's 
controls over issuance.

Weaknesses in ITIN Controls Can Contribute to Tax Fraud: 

Weak controls over the issuance of ITINs can contribute to tax fraud by 
individuals seeking to obtain a tax refund that is not truly owed to 
them. For example, if an individual uses bogus documentation to obtain 
an ITIN under a false identity, that individual could use that ITIN to 
file fraudulent tax returns that claim tax refunds. In such situations, 
the individual could attach a bogus Form W-2 to the tax return to 
create support for any wages claimed on the fraudulent return, even 
though ITIN holders generally are not authorized to have SSNs and earn 
wages in the United States.[Footnote 11]

IRS has not measured how often such tax fraud schemes related to ITINs 
have been used but has some anecdotal data. IRS has found that ITINs 
have been used in schemes that resulted in millions of dollars in 
fraudulent tax refunds. For 1999 through 2003, IRS found 12,241 tax 
returns, that used an ITIN with bogus Form W-2s attached that claimed 
refunds in excess of $22.1 million. IRS was able to stop $18 million of 
these refunds. One scheme in California over these four years accounted 
for 9,664 of these false returns.

IRS's ITIN Controls Can Be Circumvented to Obtain ITINS and Use Them 
for Non-tax Purposes: 

Before IRS instituted the changes during December 2003, we did a 
limited test to assess the security of the ITIN program controls. We 
attempted to improperly obtain and use ITINs for nontax purposes during 
September through November 2003. We were able to obtain an ITIN from 
IRS using fake identity documentation and use this ITIN as well as a 
bogus ITIN we created for nontax purposes. Although IRS changed its 
procedures after we obtained and used the ITINs, the changes made do 
not fully address the weaknesses we exploited, such as IRS's limited 
ability to verify the validity of documents. Overcoming these 
weaknesses would be challenging.

We applied for an ITIN using two methods. First, we mailed an ITIN 
application to IRS's Philadelphia Service Center using a bogus foreign 
birth certificate as proof of identity. Second, we submitted bogus 
foreign documentation as proof of identity at an IRS taxpayer 
assistance site. After we obtained an ITIN through the mailed 
application, we used it to open a bank account and obtain an ATM card. 
We did not receive the ITIN from the application submitted at the walk-
in site because we already received an ITIN for that individual through 
the mailed application; IRS apparently followed its procedure to not 
issue multiple ITINs to the same individual.

We also created a bogus ITIN displayed on a fake ITIN card. We used the 
bogus ITIN in lieu of a required SSN to obtain a Virginia voter 
registration card. Virginia requires an SSN to register to vote but 
presumably voter registration officials did not verify the number we 
put on the application.[Footnote 12] Only U.S. citizens are eligible to 
obtain a voter registration card. We were twice unsuccessful in using 
the bogus ITIN to open a bank account in the District of Columbia. 
Officials at both banks told our staff that they could not validate 
this ITIN based on their access to a credit reporting agency database.

Our test of IRS's ITIN issuance controls and whether an individual can 
use an ITIN for nontax purposes was too limited to show the extent to 
which ITIN issuance controls prevent improperly issued ITINs. Nor does 
the test show the magnitude of any abuse, in either receiving ITINs 
under false pretenses or using them for nontax purposes. Rather, the 
test indicates that IRS's ITIN process and controls could be 
circumvented, and that a person who obtains an ITIN using bogus 
documentation may have little difficulty in using the ITIN for certain 
nontax purposes.

Although IRS revised its procedures for issuing ITINs subsequent to our 
test, the changes made do not completely address the control weaknesses 
we exploited. On one hand, IRS staff will need to review fewer types of 
documents and will be further trained in 2004 on document validation 
and document inspection equipment to help identify questionable 
documents. Also, because IRS switched to a letter from an SSN-like card 
to help clarify that the issued ITIN is not an SSN, using an ITIN to 
obtain other documents may be more difficult. On the other hand, IRS 
will neither require applicants to appear in person nor verify 
documents with third parties such as the country issuing them. Thus, 
IRS remains limited in its ability to ensure that the documents 
submitted with an ITIN application are valid and that the applicant is 
the same individual described by those documents.

IRS officials said that requiring ITIN applicants to apply in-person 
and verifying documents with third parties would pose challenges, such 
as significantly delaying the issuance of ITINs and processing of 
returns that are now to be attached to ITIN applications. According to 
IRS, requiring in-person appearances would significantly burden IRS and 
applicants for various reasons. First, IRS locations that accept 
applications do not have the capacity, space or staffing to handle the 
increased ITIN traffic. Second, not all ITIN applicants live near such 
IRS locations and those in foreign countries would have virtually no 
place to go. Third, assistance to customers with other tax issues would 
be diminished, particularly when the ITIN workload now only represents 
about 7 percent of the customers assisted. IRS also noted that 
verifying identification documents would be burdensome on customers and 
costly for IRS, particularly when a significant proportion of the 
documents come from foreign sources.

Difficult Issues Arise When Illegal Resident Aliens Receive ITINS, 
Become Employed, and Receive Wage Income: 

Because many ITINs are provided to aliens who are not authorized to 
work but who nevertheless do, employers and government agencies face 
many difficult issues. Often, these issues center on what role 
employers and agencies have, or should have, in furthering the federal 
policy that immigrants should only be in the United States legally.

Employees who are illegal resident aliens likely provide employers 
inaccurate TINs, which could be either SSNs or ITINs. In this context, 
employers' concerns that they might be penalized if they provide 
inaccurate wage reports to IRS and SSA appear largely unfounded if they 
do what they are required to do. Employers also appear to have been 
concerned about what they are expected to do under the government's 
broader policies on illegal immigration. However, if employers do what 
is required in verifying the identity and work eligibility of 
employees, they appear to limit the likelihood of needing to take 
additional actions under DHS guidance related to possible illegal 
resident aliens.

When illegal resident aliens obtain employment and earn wages, IRS has 
data that could provide DHS enhanced information to use in targeting 
its enforcement efforts. However, to differing degrees, officials cite 
limited resources, other data sources available to them, legal 
restrictions, and potential impact on voluntary compliance as factors 
affecting their decisions about whether and how to share data.

Tax Returns Using ITINs Often Involve Illegal Resident Aliens and Their 
Associated Wage Statements Likely Show Up in SSA's Earnings Suspense 

IRS and TIGTA have concluded that many of the taxpayers who file tax 
returns with ITINs are illegal resident aliens. Although estimates are 
not precise, according to TIGTA, hundreds of thousands of the tax 
returns filed with ITINs each year likely involve employed illegal 
resident aliens. Because a substantial portion of these returns have 
forms W-2 attached with SSNs as the identifying number, they likely 
lead to hundreds of thousands of new records being added annually to 
SSA's earnings suspense file--a large and growing file of wage earnings 
for which SSA cannot identify the owner.

In a December 2003 letter that responded to a TIGTA report,[Footnote 
13] IRS concluded that most resident aliens who have ITINs and also 
report wage income were not legally employed in the United States 
because they used an ITIN instead of a valid SSN on their tax returns. 
If these individuals had qualified for an SSN, they would not need to 
file with an ITIN. Further, IRS said that it believes that most ITIN 
holders whose wages are reported on Forms W-2 are using stolen or 
fabricated SSNs.

In this report, TIGTA had estimated for tax year 2000 that 353,000 
resident aliens who were not authorized to work in the United States 
filed a tax return with an ITIN and also reported wages. TIGTA 
concluded that these individuals likely were unauthorized resident 
aliens (i.e., illegal resident aliens) since they did not use an SSN as 
their identifying number on the tax return. TIGTA estimated that at 
least 265,000 of these returns had Forms W-2 attached that did not use 
valid SSNs.

These illegal resident aliens can contribute to the size of SSA's 
earnings suspense file when they work and provide their employers an 
incorrect identification number and/or name. New employees are supposed 
to fill out an IRS Form W-4 (Employee's Withholding Allowance 
Certificate) when they begin employment to identify how many, if any, 
exemptions to claim for income tax withholding, and must provide their 
name and SSN. The employer uses the W-4 information to help complete a 
Form W-2 to report wages the employee earned and the amount withheld 
for income tax purposes for the calendar year. The Form W-2 is sent to 
SSA, which uses the form to record the employee's earnings for use in 
determining future benefits. After recording the wages, SSA forwards 
the Form W-2 information to IRS so that IRS can match the wages 
reported on the W-2 to those reported by the taxpayer on a tax return.

If an illegal resident alien provides an ITIN or an SSN (someone else's 
or an SSN-like number that was made up) on the W-4 and the employer 
records the name and number on a W-2 form, those numbers will show up 
as "mismatches" when SSA attempts to validate that the employee's name 
and number match those in SSA's records. In these cases, SSA posts a 
record of the wage earnings into its suspense file.

Although it is difficult to compute their precise impact, ITIN 
mismatches represent a very small portion of the postings to the 
earnings suspense file since it was created and since the ITIN was 
created. Based on a preliminary analysis in 2002 of SSA data for 1996 
(when the ITIN was created) through 2000 (the most recent year of 
available data then), the suspense file contained roughly 119,000 
numbers that looked like ITINs[Footnote 14] and wages of about $936 
million. The entire file contained over 230 million postings and more 
than $365 billion in uncredited wages through 2000. For those same 
years (1996 through 2000), about 38 million additional postings (with 
about $166 billion in wages) entered the suspense file.[Footnote 15] 
Thus, the initial computation of about 119,000 numbers with wages 
reported under likely ITINs represented about 0.3 percent of new 
postings and about 0.6 percent of new wages added to the suspense file 
between 1996 and 2000.

Illegal resident aliens' use of SSNs that are not valid for employment 
purposes likely accounts for more of the growth in SSA's suspense file 
than does their use of ITINs. We did not attempt to compute the growth 
in the suspense file that may be due to illegal resident aliens 
improperly using an SSN. However, as discussed earlier, for tax year 
2000, TIGTA estimated that at least 265,000 tax returns[Footnote 16] 
had W-2s attached that used invalid SSNs, which is higher than the 
119,000 likely ITINs in the suspense file since 1996.

If Employers Do What Is Required, They Appear to Face Little Likelihood 
of Being Penalized: 

Employers' concerns about potentially being penalized by IRS if they 
submit inaccurate wage reports--which can occur when illegal resident 
aliens provide them ITINs or SSNs upon obtaining employment--appear to 
be largely unfounded if employers do what is required. Further, if 
employers do what is required of them, they also appear to minimize 
their responsibilities to take additional actions under DHS regulations 
related to possible illegal resident aliens.

Employers have responsibilities to IRS, SSA, and DHS when they hire 
employees. In addition to the Forms W-4 and W-2 responsibilities, 
employers are responsible under DHS regulations for verifying 
employees' identity and employment eligibility. Employers must ensure 
that employees fill out a DHS Form I-9 (Employment Eligibility 
Verification Form) when they start work. Employers must review 
documents provided by employees establishing their identity and 
eligibility to work and retain the Form I-9 for 3 years after a person 
begins work or 1 year after a person's employment is terminated.

Pursuant to your interest, we contacted two groups that represent 
employers to better understand what concerns, if any, they may have 
about their responsibilities to these agencies. Officials from those 
groups did not provide us any examples where the guidance of IRS, SSA, 
and DHS were directly in conflict.

However, based on our review of two IRS letters,[Footnote 17] it 
appeared that some employers may have believed that (1) they had 
greater responsibilities than they actually do under IRS guidance and 
those perceived responsibilities might lead to penalties, and (2) 
following one agency's advice may put them at risk with another agency. 
Representatives of one of the employer groups we spoke with said that 
IRS's responses, as partially described below, allayed their concerns 
by clarifying actions employers are required to undertake.

The Information Reporting Program Advisory Committee (IRPAC), which 
represents those (such as employers) who have interests in IRS's 
information returns programs, asked IRS about any advantage or 
disadvantage to using IRS's TIN matching program or SSA's SSN 
verification systems[Footnote 18] for purposes of information reporting 
accuracy penalties.[Footnote 19] The inference from this question 
appeared to be that some employers believed they were required or 
expected to use these systems to verify that the SSN provided by an 
employee was correct. IRS's response clarified that (1) the TIN-
matching program was not available to employers for this purpose due to 
statutory restrictions and (2) employers only have to ask an employee 
fill out a Form W-4 and then can rely on the SSN as provided on that 
form. IRS clarified that under its rules employers have no 
responsibility to verify the accuracy of the SSN provided by the 

In general, IRS informed employers that they must solicit an SSN from 
the employee when the employee is hired by having the employee fill out 
a Form W-4. The employer should retain the Form W-4 in its records and 
use the SSN provided on the Form W-4 when completing a W-2 to report 
wages paid to the employee. If IRS subsequently notifies the employer 
that the SSN is invalid, the employer may need to solicit an SSN from 
the employee once or twice more. The employer may rely on the SSN 
provided by the employee with no further verification.

The employers' questions to IRS also implied that they were concerned 
that fulfilling their responsibilities to IRS might create the need to 
take action to comply with DHS requirements. In its letter to IRS, 
IRPAC noted that federal immigration representatives had told some 
employers that if an employer used SSA's SSN verification system or 
IRS's TIN matching program, a mismatch notice would constitute 
constructive notice of a possible work authorization issue. In general, 
if questions arise about an employee's work authorization, DHS guidance 
provides that an employer might need to take certain actions, such as 
providing the employee another opportunity to provide proper Form I-9 
documentation. We did not verify whether a mismatch could be 
constructive notice of a work authorization issue. However, because 
employers cannot use the TIN matching program for this purpose and are 
not required to use SSA's SSN verification system, employers can avoid 
possibly having constructive notice of a work authorization issue by 
simply not verifying an employee's identity.

Greater Data Sharing Regarding ITIN Taxpayers Might Help DHS Identify 
Illegal Immigrants, But Several Issues Affect Any Decision to Increase 
Data Sharing: 

Enhanced sharing of IRS data might help DHS in addressing illegal 
immigration, but whether and how to share data is a complex policy 
issue. Such data sharing could provide DHS additional information to 
use in targeting its enforcement efforts. However, to differing 
degrees, officials cite limited resources, other data sources available 
to them, legal restrictions, and potential impact on voluntary 
compliance as factors affecting their decisions about whether and how 
to share data.

Among IRS's principal responsibilities, IRS is to ensure that all 
taxpayers meet their tax obligations, including illegal resident aliens 
who are not authorized to work in the United States but who have a tax 
obligation. Among SSA's responsibilities is ensuring that individuals 
who have paid social security taxes on their covered earnings receive 
credit. Such credit is important so that workers will receive the 
benefits to which they are entitled based on their work, even persons 
with such earnings from unauthorized work. In addition to other 
responsibilities, DHS is responsible for enforcing the nation's 
immigration laws, including deterring illegal immigration and locating 
and deporting illegal resident aliens.

As discussed earlier, IRS data may identify hundreds of thousands of 
individuals who are likely to be illegal resident aliens. Individuals 
who obtain ITINs and report wage income on a tax return may be illegal 
resident aliens. IRS has data that could be used to identify illegal 
resident aliens and/or their employers. The data would include such 
specifics as an individual's name, address, and place(s) of employment 
in the last calendar year.

Although DHS officials we spoke with said that IRS data might be useful 
in carrying out their responsibilities, they noted that they have other 
sources of data on illegal immigrants and have limited resources to 
pursue all potential leads on illegal immigration. Further, they 
recognized that current statutory restrictions on sharing tax data 
would need to be modified to permit sharing of IRS data with 
them.[Footnote 20]

IRS officials similarly noted a number of issues that relate to 
increasing data sharing among the agencies. IRS officials said that 
they cannot share these data with DHS under current statutory 
restrictions on the sharing of tax data. IRS officials also said that 
any consideration of additional sharing of tax data with federal 
agencies requires substantial justification and should be considered in 
rare circumstances because the confidentiality of tax data is 
considered to be fundamental to taxpayers' willingness to voluntarily 
and accurately report their tax obligations. Finally, IRS officials 
also noted a potential adverse effect of increased data sharing. To the 
extent that illegal resident aliens become aware of greater sharing of 
information by IRS with other agencies, some of the individuals may 
move into "underground" jobs and avoid their tax obligations. Thus, IRS 
faces a fundamental tension in considering steps that might further 
other agencies' achievement of their missions but that potentially 
undercut IRS's ability to ensure that all taxpayers, regardless of 
their legal immigration status, meet their tax obligations.

Concluding Observations: 

IRS's creation of the ITIN helped it resolve several tax administration 
challenges. However, in creating the ITIN, IRS opened an avenue for 
individuals to use to establish an identity and to blend into society. 
IRS's controls over the issuance of ITINs have been limited and 
consequently, we had little difficulty obtaining an ITIN with bogus 
documents and then using that ITIN, as well as a completely made up 
ITIN, to take additional steps to blend into society. IRS's recent 
efforts to improve its ITIN issuance process--which changed the 
application procedures from those we tested--might make it somewhat 
more difficult to obtain an ITIN with bogus information but do not 
fully address the weaknesses we exploited.

Because a significant but not precisely known number of ITIN holders 
are illegal resident aliens, tax return data that IRS receives could 
potentially assist DHS in carrying out enforcement of immigration laws. 
However, agency officials have not aggressively sought to enhance data 
sharing, citing limited resources, legal restrictions, and possible 
voluntary compliance impacts. Changing the current statutory provisions 
that limit the sharing of tax-related data with agencies or emphasizing 
enhanced efforts by IRS, SSA, and DHS to address the presence of 
illegal resident aliens are difficult policy issues. For instance, to 
what extent would increased data sharing undermine the willingness of 
taxpayers to voluntarily and accurately report information IRS needs to 
administer tax laws? What priority should these agencies place on 
addressing illegal resident aliens versus their other responsibilities? 
Given the legal, budgetary, and policy issues attendant to increased 
data sharing, this hearing is one opportunity for Congress to consider 
whether to provide new guidance to the agencies on how to proceed.

Messrs. Chairman, this concludes my prepared statement. I would be 
happy to respond to any questions you or other Members of the 
Subcommittees may have at this time.

For further information on this testimony, please contact Michael 
Brostek at (202 512-9110) or [Hyperlink,]. Individuals 
making key contributions to this testimony include George Guttman, Jay 
Pelkofer, and Tom Short.



[1] In this testimony, we use the term alien to mean a foreign-born 
individual who has not been naturalized and is still a subject or 
citizen of a foreign country. A resident alien is someone meeting this 
definition but also considered a resident of the United States for tax 
purposes, as described later in this testimony. A nonresident alien 
does not reside in the United States, but may have a need to interact 
with IRS. For this testimony, we defined an illegal resident alien is a 
resident alien who is not legally in the United States and also may 
refer to them as illegal aliens, undocumented workers, or unauthorized 
resident aliens.

[2] SSA officials said that they also receive other identification 
numbers that start with "9".

[3] A green card is an identity document issued to lawful permanent 
residents by DHS that attests to the permanent residence status of an 
individual in the United States. 

[4] 26 U.S.C. §7701(b)(1)(A).

[5] The masterfile is a record of transactions in a taxpayer's account. 
If a taxpayer has a TIN, IRS posts account information to the valid 
segment of the masterfile. Otherwise, IRS posts the information to the 
invalid segment. 

[6] United States General Accounting Office, Tax Administration: IRS 
Could Do More To Verify Taxpayer Identities, GAO/GGD-95-148 
(Washington, D.C.: Aug. 30, 1995).

[7] IRS issued 60,682 ITINs in 1996; 1,363,071 in 1997; 566,745 in 
1998; 615,413 in 1999; 818,392 in 2000; 1,088,837 in 2001; 1,493,284 in 
2002; 1,229,097 in 2003; and 77,759 through Feb. 13, 2004.

[8] A list of acceptance agents that are available to the general 
public is available on the IRS Web site (

[9] Other documents include an identification card issued by U.S. or 
foreign military agencies, a state, or a national government; a DHS 
photo identification; birth certificate; and medical or school records 
for dependents.

[10] Applicants who are not authorized to work but report wage income 
on the tax return could still qualify for an ITIN, as discussed 
elsewhere in this testimony.

[11] By analyzing a sample of tax returns filed in tax years 1999 and 
2000 with an ITIN for the primary filer, IRS estimated that more than 
90 percent of the returns also reported wage income.

[12] Given the limited time to do our work, our test only included 
Virginia. We do not know whether other states also would have issued us 
a voter registration card in this manner. Since we did our test, 
Virginia has announced changes to strengthen its checks of 
identification documentation such as for a driver's license.

[13] Internal Revenue Service's Individual Taxpayer Identification 
Number Creates Significant Challenges for Tax Administration, Treasury 
Inspector General for Tax Administration, Jan. 2004, Reference Number 

[14] We did not confirm that each Form W-2 actually reported an ITIN 
because we did not cross match the SSA records with an IRS file of 
issued ITINs. Rather, we counted all numbers in the suspense file that 
appeared to be an ITIN due to their ITIN-like format.

[15] For a number of reasons, the number of suspense file accounts 
fluctuates daily, making a precise count difficult. While new accounts 
enter the suspense file, others are withdrawn. SSA has the ability to 
resolve certain types of identification problems for some of the 
accounts. Also, individuals come to SSA to report errors in their 
earnings records. These numbers on the accounts in the suspense file 
cover through tax year 2000, as of November 2003.

[16] In its report, TIGTA stated that computed the margin of error for 
this estimate was plus or minus 17,732.

[17] On July 24, 2002, the American Society for Payroll Management sent 
a letter and IRS responded to their concerns on January 13, 2003. A set 
of follow-up questions produced another IRS response on September 23, 

[18] TIN Matching is an IRS program that allows payers who submit 
certain information returns subject to backup withholding taxes when 
the payee does not provide a TIN to match payee TIN and name 
combinations against IRS records prior to submitting information 
returns. SSA's verification system is a system that employers may 
choose to use in an effort to verify that an SSN matches a given 
individual's name. 

[19] 26 U.S.C. §6721 provides for a penalty for failure to file a 
complete and accurate information return, including a failure to 
include the correct TIN (or SSN). The penalty is $50 per return up to 
$250,000 per year.

[20] Section 6103 of the Internal Revenue Code allows IRS to disclose 
taxpayer information to federal agencies and authorized employees of 
those agencies, but only under specific conditions. Section 6103 does 
not currently authorize data sharing between IRS and DHS specifically 
for immigration enforcement.